mecord-connect 1.0.0

package/runtime/app/src/core/public-restricted-data.js

@@ -0,0 +1,105 @@
+import path from 'node:path';
+import { OperatorError } from './errors.js';
+
+const SENSITIVE_BASENAMES           = [
+  /^\.env(?:\..+)?$/i,
+  /^\.npmrc$/i,
+  /^\.netrc$/i,
+  /^credentials(?:\..+)?$/i,
+  /^service[-_.]?account.*\.json$/i,
+  /^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/i,
+  /^authorized_keys$/i,
+  /^kubeconfig$/i,
+  /^wallet(?:\..+)?$/i,
+  /^.*\.(?:pem|key|p12|pfx|kdbx)$/i
+];
+
+const SENSITIVE_SEGMENTS = new Set([
+  '.ssh', '.aws', '.azure', '.gnupg', '.docker',
+  'credentials', 'secrets', 'passwords'
+]);
+
+const SECRET_PATTERNS           = [
+  /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/i,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\b(?:ghp|gho|ghu|ghs|ghr|github_pat)_[A-Za-z0-9_]{20,}\b/,
+  /\bglpat-[A-Za-z0-9_-]{20,}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+  /\bAIza[0-9A-Za-z_-]{30,}\b/,
+  /\bsk_(?:live|test)_[0-9A-Za-z]{16,}\b/,
+  /\bsk-[A-Za-z0-9_-]{20,}\b/,
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/,
+  /\b(?:authorization|proxy-authorization)\s*:\s*(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/i,
+  /\b(?:otp|one[- ]time(?: password| code)?|verification code|recovery code)\s*[:=]\s*[A-Za-z0-9-]{4,20}\b/i,
+  /\b(?:ssn|social security(?: number)?|aadhaar|aadhar|passport(?: number)?|driver'?s? license(?: number)?)\s*[:=]\s*[A-Za-z0-9 -]{5,32}\b/i,
+  /\b(?:medical record(?: number)?|mrn|diagnosis|patient(?: name| id)|health insurance(?: number)?)\s*[:=]\s*[^\r\n]{2,96}/i,
+  /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|mssql|redis):\/\/[^\s:@/]+:[^\s@/]+@[^\s"']+/i,
+  /\b(?:DATABASE_URL|REDIS_URL|MONGODB_URI)\s*[:=]\s*["']?[^\s"']+:[^\s"']+@[^\s"']+/i,
+  /\b(?:API[_-]?KEY|APIKEY|ACCESS[_-]?KEY(?:_ID)?|SECRET[_-]?KEY|CLIENT[_-]?SECRET|ACCESS[_-]?TOKEN|REFRESH[_-]?TOKEN|AUTH[_-]?TOKEN|_AUTH(?:TOKEN)?|NPM_TOKEN)\s*[:=]\s*["']?[^\s"']{8,}["']?/i,
+  /\bAWS_SECRET_ACCESS_KEY\s*[:=]\s*["']?[A-Za-z0-9/+=]{20,}["']?/i,
+  /\b(?:PASSWORD|PASSWD|PWD)\s*[:=]\s*["']?[^\s"';,}{]{4,}["']?/i,
+  /\b(?:AccountKey|SharedAccessKey)\s*=\s*[A-Za-z0-9+/=]{16,}/i,
+  /\b(?:session|sessionid|session_id|auth_cookie|cookie)\s*[:=]\s*["']?[A-Za-z0-9._~+%/=-]{12,}["']?/i
+];
+const SENSITIVE_KEYS = /(?:password|passwd|pwd|secret|token|api.?key|access.?key|client.?secret|authorization|private.?key|otp|cvv|card.?number|ssn|social.?security|aadhaar|aadhar|passport|driver.?license|medical.?record|mrn|diagnosis|patient.?name|patient.?id|health.?insurance|account.?key|cookie|session)/i;
+
+export function assertPublicSafePath(input        )       {
+  const normalized = String(input ?? '').replace(/\\/g, '/');
+  const segments = normalized.split('/').filter(Boolean);
+  const basename = segments.at(-1) ?? '';
+  if (SENSITIVE_BASENAMES.some((pattern) => pattern.test(basename))) {
+    throw new OperatorError('RESTRICTED_DATA_PATH_DENIED', 'The public plugin cannot access credential or secret-bearing files.');
+  }
+  if (segments.some((segment) => SENSITIVE_SEGMENTS.has(segment.toLowerCase()))) {
+    throw new OperatorError('RESTRICTED_DATA_PATH_DENIED', 'The public plugin cannot access credential or secret-bearing directories.');
+  }
+}
+
+export function containsRestrictedData(value         , keyHint = '')          {
+  if (value === null || value === undefined) return false;
+  if (typeof value === 'string') {
+    if (keyHint && SENSITIVE_KEYS.test(keyHint) && value.length > 0) return true;
+    if (SECRET_PATTERNS.some((pattern) => pattern.test(value))) return true;
+    return containsPaymentCard(value);
+  }
+  if (Array.isArray(value)) return value.some((item) => containsRestrictedData(item, keyHint));
+  if (typeof value !== 'object') return false;
+  return Object.entries(value                           )
+    .some(([key, item]) => containsRestrictedData(item, key));
+}
+export function assertNoRestrictedData(value         )       {
+  if (!containsRestrictedData(value)) return;
+  throw new OperatorError(
+    'RESTRICTED_DATA_BLOCKED',
+    'The public plugin refused content that may contain credentials, payment data, authentication codes, or other restricted data.'
+  );
+}
+
+export function isSensitiveEntryName(name        )          {
+  const base = path.basename(String(name ?? ''));
+  return SENSITIVE_BASENAMES.some((pattern) => pattern.test(base))
+    || SENSITIVE_SEGMENTS.has(base.toLowerCase());
+}
+
+function containsPaymentCard(text        )          {
+  const candidates = text.match(/(?:\d[ -]?){13,19}/g) ?? [];
+  return candidates.some((candidate) => {
+    const digits = candidate.replace(/\D/g, '');
+    return digits.length >= 13 && digits.length <= 19 && luhn(digits);
+  });
+}
+
+function luhn(digits        )          {
+  let sum = 0;
+  let double = false;
+  for (let index = digits.length - 1; index >= 0; index -= 1) {
+    let value = Number(digits[index]);
+    if (double) {
+      value *= 2;
+      if (value > 9) value -= 9;
+    }
+    sum += value;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}

package/runtime/app/src/core/rate-limit.js

@@ -0,0 +1,118 @@
+import crypto from 'node:crypto';
+import { isIP } from 'node:net';
+                                  
+
+                                 
+                   
+                    
+                            
+  
+
+                                                        
+
+export class FixedWindowRateLimiter {
+  #limit        ;
+  #windowMs        ;
+  #maxKeys        ;
+  #clock              ;
+  #entries = new Map               ();
+
+  constructor(options                                                                             ) {
+    if (!Number.isInteger(options.limit) || options.limit < 1) throw new Error('Rate limit must be a positive integer.');
+    if (!Number.isInteger(options.windowMs) || options.windowMs < 1000) throw new Error('Rate-limit window must be at least 1000ms.');
+    this.#limit = options.limit;
+    this.#windowMs = options.windowMs;
+    this.#maxKeys = options.maxKeys ?? 20_000;
+    if (!Number.isInteger(this.#maxKeys) || this.#maxKeys < 1 || this.#maxKeys > 1_000_000) throw new Error('Rate-limit maxKeys is invalid.');
+    this.#clock = options.clock ?? Date.now;
+  }
+
+  hit(keyInput        )                    {
+    const key = boundedKey(keyInput);
+    const now = this.#clock();
+    let entry = this.#entries.get(key);
+    if (entry && now - entry.windowStartedAt >= this.#windowMs) {
+      this.#entries.delete(key);
+      entry = undefined;
+    }
+    if (!entry) {
+      this.#evictForInsert();
+      entry = { count: 0, windowStartedAt: now };
+    }
+    entry.count += 1;
+    this.#touch(key, entry);
+    const remaining = Math.max(0, this.#limit - entry.count);
+    const retryAfterSeconds = Math.max(1, Math.ceil((entry.windowStartedAt + this.#windowMs - now) / 1000));
+    return { allowed: entry.count <= this.#limit, remaining, retryAfterSeconds };
+  }
+
+  isLimited(keyInput        )                    {
+    const key = boundedKey(keyInput);
+    const now = this.#clock();
+    const entry = this.#entries.get(key);
+    if (!entry || now - entry.windowStartedAt >= this.#windowMs) {
+      if (entry) this.#entries.delete(key);
+      return { allowed: true, remaining: this.#limit, retryAfterSeconds: 1 };
+    }
+    this.#touch(key, entry);
+    return {
+      allowed: entry.count < this.#limit,
+      remaining: Math.max(0, this.#limit - entry.count),
+      retryAfterSeconds: Math.max(1, Math.ceil((entry.windowStartedAt + this.#windowMs - now) / 1000))
+    };
+  }
+
+  clear(keyInput        )       {
+    this.#entries.delete(boundedKey(keyInput));
+  }
+
+  get size()         { return this.#entries.size; }
+
+  #touch(key        , entry       )       {
+    this.#entries.delete(key);
+    this.#entries.set(key, entry);
+  }
+
+  #evictForInsert()       {
+    if (this.#entries.size < this.#maxKeys) return;
+    const oldest = this.#entries.keys().next().value                      ;
+    if (oldest !== undefined) this.#entries.delete(oldest);
+  }
+}
+
+export function requestClientKey(request                      )         {
+  const peer = normalizeIp(request.socket.remoteAddress ?? '');
+  const forwarded = request.headers['x-forwarded-for'];
+  if (isLoopback(peer) && typeof forwarded === 'string') {
+    const first = normalizeIp(forwarded.split(',')[0]?.trim() ?? '');
+    if (isIP(first)) return `ip:${first}`;
+  }
+  return `ip:${peer || 'unknown'}`;
+}
+
+export function principalRateKey(issuer        , subject        )         {
+  return `principal:${crypto.createHash('sha256').update(JSON.stringify({ issuer, subject }), 'utf8').digest('base64url')}`;
+}
+
+function boundedKey(value        )         {
+  const text = String(value ?? '');
+  if (!text || text.length > 512 || /[\0\r\n]/.test(text)) throw new Error('Rate-limit key is invalid.');
+  return text;
+}
+
+function normalizeIp(input        )         {
+  const value = String(input ?? '').trim().toLowerCase();
+  if (value.startsWith('::ffff:')) return value.slice(7);
+  return value.replace(/^\[|\]$/g, '');
+}
+
+function isLoopback(input        )          {
+  return input === '127.0.0.1' || input === '::1' || input === 'localhost';
+}
+
+export function envRateLimit(value                    , fallback        , label        )         {
+  if (value === undefined || value.trim() === '') return fallback;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed < 1 || parsed > 100_000) throw new Error(`${label} must be an integer between 1 and 100000.`);
+  return parsed;
+}